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DETAILED ACTION 

1 . This action is responsive to tlie communication filed on October 6, 201 0. Claims 
10-22 and 24-25 are pending of which claims 10, 13, 20 and 24 are independent and 
the remainder dependent. Applicant amended all independent and dependent claims, 
cancelling claims 23 and 26 in addition to previously cancelled claims 1-9. 

Response to Arguments 

2. In the "Remarks" filed on October 6, 201 0, Applicant's arguments and 
amendments with respect to the rejection of claims 10-22 and 24-25 have been fully 
considered and are persuasive. However, further search yielded additional prior art 
(Apap et a!., US 7,448,084) that Examiner believes meets the limitation "the number of 
distinct values" argued by the Applicant on pages 10-12 of the "Remarks." The 
Examiner further believes that when the prior art Chesia already employing the use of 
"ratios" in detecting an attack (see at least paragraph [0029]) is combined with Apap 
and Chao would render the instant invention obvious; hence, at this time, the Examiner 
believes that the rejection of claims 10-22 and 24-25 should be maintained. 
Additionally, further review of the instant application resulted in additional claim 
objections and rejections as set forth below. 



Examiner's Note 



4. While particular columns and line numbers in the prior art references are cited 
and applied against the claims by the Examiner in an Office action, it is done so for the 
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convenience of tlie Applicant(s). Altliougli tine specified citations are representative of 
the teachings in the art and are applied to the specific limitations within the individual 
claims, other passages and figures in the prior art references may apply as well. It is 
respectfully requested that, In preparing responses, the Appljcant(s) fully consider the 
prior art references in their entirety as potentially teaching all or part of the claimed 
invention as well as the context of the passages taught by the prior art or disclosed by 
the Examiner. 

Claim Objections 

5. Claims 1 0 and 1 5-20 are objected to because of the following informalities: 

on line 32 of claim 10, the word --or-- needs to be added after the semi-colon and 
before condition (d) since the four conditions (a through d) are written in the alternative; 

on line 1 of claims 15-19, for consistency, the word "tracking" needs to be 
replaced by -detection--; 

on line 29 of claim 20, the comma after the word "progress" needs to be changed 
to a -semi-colon (;)- to be followed by the word -or- instead of "and" since the four 
conditions (a through d) are written in the alternative; additionally, there's a missing 
colon (:) after the word "satisfied" on line 10; and conditions a-b also need to end with a 
semi-colon vice a comma. 

In addition, since the four conditions of claims 10 and 20 are written in the 
alternative, all variables should be defined within each condition or prior to all the 
conditions (for example, "based on one of the following conditions where "N(t)" is a 
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number of distinct values observed, "P(t)" is a number of packets in transmission, 
etc... then start listing or enumerating the alternative conditions). 
Appropriate corrections are required. 

Claim Rejections - 35 USC § 1 12 

6. The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification sliall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

7. Claims 1 0 and 20 are rejected under 35 U.S.C. 1 1 2, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
Applicant regards as the invention. 

On line 12 of claimlO, using the introductory phrase "based on one of the 
following conditions", four conditions (a through d) are written in the alternative, 
meaning each condition should be able to stand on its own and yet condition (c) is 
written to depend on (b) "if the ratio of the coefficient computed in (b)" (line 28), making 
the claim unclear or indefinite. 

Similar problem is found in claim 20 where condition (c) is written to depend on 
(b) "if the ratio of the coefficient computed in (b)" (line 25). 

Also, claims 10 and 20 recite the limitation "the coefficient computed in (b)" in line 
28 and 25 respectively. There is insufficient antecedent basis for this limitation in the 
claim since there is no "coefficient" mentioned in (b). 
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Claim Rejections - 35 USC § 101 

8. 35 U.S.C. § 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

9. Claims 10-19 are rejected under 35 U.S.C. § 101 because the claimed invention 
is directed to non-statutory subject matter. 

As to independent claim 10, this claim when read in light of the specification, can 
be interpreted as being directed toward program/software per se. Applicant is reminded 
that a program and/or software cannot be patentable. Independent claim 1 0 recites a 
"system" performing a series of steps but reciting no element that is a physical part of a 
device. When a system claim, in at least one possible way, can be implemented by 
software alone and the claim does not contain any element that is a physical part of a 
device, the claim must be rejected under 35 U.S.C. §101 as non-statutory since the 
claim does not fall under one of the four statutory categories of invention (Process, 
Machine, Manufacture or Composition of Matter). 

Dependent claims 11-12 and 15-17 do not recite nor impart any further limitations 
that would bring the invention in conformance with 35 U.S.C. §101 as patentable 
subject matter. 

Similarly, independent claim 13 recites a "system" but recites not a single 
element that is a physical part of a device and the claim, when read in light of the 
specification, can be interpreted as being directed to a program and/or software. When 
a system claim, in at least one possible way, can be implemented by software alone 
and the claim does not contain any element that is a physical part of a device, the claim 
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must be rejected under 35 U.S.C. §101 as non-statutory since tine claim does not fall 
under one of the four statutory categories of invention (Process, Machine, Manufacture 
or Composition of Matter). 

Dependent claims 14 and 18-19 do not recite nor impart any further limitations 
that would bring the invention in conformance with 35 U.S.C. §101 as patentable 
subject matter. 

Claim Rejections - 35 USC § 103 

1 0. The following is a quotation of 35 U.S.C. § 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

1 1 . Claims 1 3-1 4 and 24-25 are rejected under 35 U.S.C. § 1 03(a) as being 
unpatentable over Chesia et al. (US 2004/0250124; hereinafter Chesia) in view of Apap 
et al. (US 7,448,084; hereinafter Apap). 

As per claim 13, Chesia discloses a network attack detection system, wherein it 
is judged that an illegal attack has taken place by observing the values of the packet 
header fields (see at least Para. [0023], lines 5-8: performing statistical analysis on 
one or more packet header fields to detect an attack). 

Chesia does not specifically disclose: 
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"and when the number of distinct values seen in a combination of two or more 
header fields exceeds a pre- specified threshold value within a pre-specified time, it is 
judged that an attack is in progress." 

However, Apap discloses that statistics gatiiered in observing liow many 
distinct values occur in a monitored feature and compared against a model of 
normal usage in a registry access system can be used in detecting malicious 
activity (Col. 12, lines 51-60). 

Therefore it would have been obvious to a person having ordinary skill in the art 
at the time the invention was made to modify Chesia and incorporate Apap to meet the 
preceding limitation not explicitly disclosed by Chesia. The motivation is to detect if an 
access is malicious (Apap: Col. 12, line 45). 

As per claim 14, Chesia in view of Apap discloses the network attack detection 
system according to claim 13, wherein the iudament is made that an attack is in 
progress, if the Time to Live (TTL) value in the header of the packet does not lie in the 
range of the values seen beforehand for the source address in the header of the packet 
(see at least Chesia, Para. [0045]: one of the header fields that is monitored is 
time-to-live (TTL) when detecting an attack). 

As per claim 24, Chesia discloses a method for detecting a network attack, 

comprising the step of: 



Application/Control Number: 1 0/588,1 88 Page 8 

Art Unit: 2438 

observing values of pacl^et lieader fields (see at least Para. [0023], lines 5-8: 
performing statistical analysis on one or more packet header fields to detect an 
attacl(). 

Chesia does not explicitly disclose: 

"and upon observing that a number of distinct values seen in a combination of 
two or more header fields exceeds a pre-specified threshold value within a pre-specified 
time, judging that an unauthorized attack is in progress." 

However, Apap discloses that statistics gathered in observing how many 
distinct values occur in a monitored feature and compared against a model of 
normal usage in a registry access system can be used in detecting malicious 
activity (Col. 12, lines 51-60). 

Therefore it would have been obvious to a person having ordinary skill in the art 
at the time the invention was made to modify Chesia and incorporate Apap to meet the 
preceding limitation not explicitly disclosed by Chesia. The motivation is to detect if an 
access is malicious (Apap: Col. 12, line 45). 

As per claim 25, Chesia in view of Apap discloses the method of claim 24, 
wherein a Time To Live (TTU value in the packet header is observed , and the 
unauthorized attack in progress is judoed upon the observed TTL value being outside a 
range of the values seen beforehand for the source address in the packet header (see 
at least Para. [0025-0026]; [0045]: for example, as part of measuring a property of 
traffic entering the network and applying a fuzzy logic algorithm to detect an 
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attack; packet header fields that are monitored include time-to-live (TTL), source 
IP address, packet size, and so on). 

1 2. Claims 1 0-1 2, 1 5-1 7 and 20-22 are rejected under 35 U.S.C. § 1 03(a) as being 
unpatentable over Chesia in view of Apap and further in view of Chao et al. (US 
7,526,807; hereinafter Chao). 

As per claim 10, Chesia discloses a network attack detection system, comprising 
the steps of: 

examining a header of a packet in transmission (see at least Para. [0023], lines 
5-8: performing statistical analysis on one or more packet header fields): 

observing values of one or more pre-specified fields in the packet header (Para. 
[0045]: for example, TTL field, source IP address field, etc). 

Chesia does not explicitly disclose: 

"and in a case where a number of distinct values observed in the pre-specified 
fields reaches a pre-specified threshold within a pre-specified time interval, iudaina that 
an unauthorized attack is in progress." 

However, Apap discloses that statistics gathered in observing how many 
distinct values occur in a monitored feature and compared against a model of 
normal usage in a registry access system can be used in detecting malicious 
activity (Col. 12, lines 51-60). 

Therefore It would have been obvious to a person having ordinary skill In the art 
at the time the invention was made to modify Chesia and incorporate Apap to meet the 
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preceding limitation not explicitly disclosed by Chesla. The motivation is to detect if an 
access is malicious (Apap: Col. 12, line 45). 

Chesla in view of Apap does not explicitly disclose: 

"wherein the judqinq Is carried out based on one of the following conditions: 

(a) N(t) is the number of distinct values of the field observed within a pre- 
speclfled time Interval from time t, N(ti) is the number of distinct values of the field 
observed within the pre-specified time interval from some time ti and if the ratio of N(t) 
to N(ti) Is greater than or equal to a first pre-specified threshold ki, that Is, If N(t)/ N(ti) ^ 
ki, the system will judge that an attack is in progress; 

(b) P(t) Is the number of packets in transmission within the pre-speclfled time 
interval from time t, and if the ratio of the number of N(t) to P(t) is greater than or equal 
to a second pre-specified threshold k2, that is, N(t)/P(t) > k2, the system will judge that 
an attack is in progress; 

(c) P(ti) is the number of packets in transmission within the pre-specified time 
interval from some time ti, and if the ratio of the coefficient computed in (b) above for 
the time t to that computed for the time ti, {N(t)/P(t)} / {N(ti)/P(ti)}, is greater than or 
equal to a third pre-specified threshold ka, that is, {N(t)/P(t)} / {N(ti)/P(ti) } > ks, the 
system will judge that an attack is under progress; 

(d) T{t) Is the number of octets or bits in the packets in transmission within the 
pre-specified time interval from some time t, and if the ratio N(t) to T(t) is greater than or 
equal to a fourth pre-specified threshold k4, that is, N{t)/T(t) > k4, the system will judge 
that an attack is in progress." 
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However, Chao discloses, in one embodiment, DCS 108 performing aggregation 
function 222 by comparing measured attribute values to nominal attribute values, 
wherein if the measured attribute value exceeds a predetermined threshold, DCS 108 
may conclude that the packets are suspect, as in part of an attack (see at least Figure 
5 and Col. 9, lines 30-38: as stated by Chao's disclosure, one skilled in the art 
would appreciate that various thresholds and combinations thereof may be used 
to determine whether packets are suspect). 

Therefore it would have been obvious to a person having ordinary skill in the art 
at the time the invention was made to modify Chesia and incorporate Chao to meet the 
preceding limitations not explicitly disclosed by Chesia and Apap. The motivation is to 
provide a distributed, adaptive Internet Protocol (IP) filtering system and technique to 
detect and block packets involved in a DDoS attack (Chao: Col. 2, lines 57-60). 

As per claim 1 1 , Chesia in view of Apap and Chao discloses the network attack 
detection system according to claim 10, wherein arbitrary combinations of two or more 
header fields are allowed, and the number of distinct values observed for the resultant 
composite field is used to compute the coefficient which is compared against the 
threshold (see at least Chesia: Para. [0025-0026]: for example, as part of 
measuring a property of traffic entering the network and applying a fuzzy logic 
algorithm to detect an attack). 
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As per claim 12, Cliesia in view of Apap and Cliao discloses the network attach 
detection system according to claim 10, wherein an illegal attack is inferred to be 
underway when the Time To Live (TTL) value in the header field of a packet does not lie 
in the range of the values seen beforehand for the source address in the header of 
packets (see at least Chesia: Para. [0045]: one of the header fields that Is 
monitored is time-to-live (TTL) when detecting an attack) . 

As per claim 15, Chesia in view of Apap discloses the network attack tracking 
system according to claim 10. 

Chesia in view of Apap does not explicitly disclose: 

" wherein a source of the unauthorized attack is searched by deploving these 
systems at various places on the Internet." 

However, Chao discloses denial-of-service control servers that are distributed in 
a given network to form a system configured to protect against DDoS attack (see at 
least Fig. 1 and Col. 3, lines 56-67). 

Therefore it would have been obvious to a person having ordinary skill in the art 
at the time the invention was made to modify Chesia and Apap and incorporate Chao 
such that the system as being characterized in that a source of the unauthonzed attack 
is searched by setting these systems at various places on the Internet. The motivation 
is to provide a distributed, adaptive Internet Protocol (IP) filtering system and technique 
to detect and block packets involved in a DDoS attack (Chao: Col. 2, lines 57-60). 
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As per claim 16, Cliesia in view of Apap and Cliao discloses the network attack 
tracking system according to claim 1 1 . 

Chesia in view of Apap does not explicitly disclose: 

" wherein a source of the unauthorized attack is searched by deplovinq these 
systems at various places on the Internet." 

However, Chao discloses denial-of-service control servers that are distributed in 
a given network to form a system configured to protect against DDoS attack (see at 
least Fig. 1 and Col. 3, lines 56-67). 

Therefore it would have been obvious to a person having ordinary skill in the art 
at the time the invention was made to modify Chesia and Apap and incorporate Chao 
such that the system as being characterized in that a source of the unauthorized attack 
is searched by setting these systems at various places on the Internet. The motivation 
is to provide a distributed, adaptive Internet Protocol (IP) filtering system and technique 
to detect and block packets involved in a DDoS attack (Chao: Col. 2, lines 57-60). 

As per claim 17, Chesia in view of Apap and Chao discloses the network attack 
tracking system according to claim 12. 

Chesia in view of Apap does not explicitly disclose: 

" wherein a source of the unauthorized attack is searched by deplovinq these 
systems at various places on the Internet." 
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However, Chao discloses denial-of-service control servers that are distributed in 
a given network to form a system configured to protect against DDoS attack (see at 
least Fig. 1 and Col. 3, lines 56-67). 

Therefore it would have been obvious to a person having ordinary skill in the art 
at the time the invention was made to modify Chesia and Apap and incorporate Chao 
such that the system as being characterized in that a source of the unauthorized attack 
is searched by setting these systems at various places on the Internet. The motivation 
is to provide a distributed, adaptive Internet Protocol (IP) filtering system and technique 
to detect and block packets involved in a DDoS attack (Chao: Col. 2, lines 57-60). 

As per claim 20, Chesia discloses a method for detecting a network attack, 
comprising the steps of: 

examining a pre-specified field in a header of a packet in transmission for distinct 
values (see at least Para. [0023], lines 5-8: performing statistical analysis on one 
or more packet header fields). 

Chesia does not explicitly disclose: 

"and determining that an unauthorized attack is in progress based on an 
observed number of distinct values in the examined pre-specified header field reaching 
a pre-specified threshold within a pre-specified time interval." 

However, Apap discloses that statistics gathered in observing how many 
distinct values occur In a monitored feature and compared against a model of 
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normal usage in a registry access system can be used in detecting malicious 
activity (Col. 12, lines 51-60). 

Therefore it would have been obvious to a person having ordinary skill in the art 
at the time the invention was made to modify Chesia and incorporate Apap to meet the 
preceding limitation not explicitly disclosed by Chesia. The motivation is to detect if an 
access is malicious (Apap: Col. 12, line 45). 

Chesia in view of Apap does not explicitly disclose: 

"wherein, the determination includes that at least one of the following conditions 
is satisfied 

(a) N(t) is the number of the distinct values of the field observed within the pre- 
specified time interval from some time t, N(ti) is the number of distinct values of the field 
observed within the pre-specified time interval from some time ti and if the ratio of N(t) 
to N(ti) is greater than or equal to a first pre-specified threshold ki, that is N(t)/N(ti) ^ ki, 
it will be judged that an attack is in prooress. 

(b) P(t) is the number of packets in transmission within the pre-specified time 
interval from some time t, and if the ratio of N(t) to P(t) is greater than or equal to 

a second pre-specified threshold k2, that is, N(t)/P(t) > kz, it will be judged that an attack 
is in prooress. 

(c) P(ti) is the number of packets in transmission within the pre-specified time 
interval from the time ti, and if the ratio of the coefficient computed in (b) above for the 

time t to that computed for the time ti, {N(t)/P(t)} / {N(ti)/P(ti)}, is greater than or equal to 
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a third pre-specified tliresliold ks, tliat is, {N(t)/P(t)} / {N(ti)/P(ti)} > k3, it will be judged 
that an attack is in progress, and 

(d) T(t) is the number of octets or bits in the packets in transmission within the 
pre-specified time interval from some time t, and if the ratio N(t) to T(t) is greater than or 
equal to a fourth pre-specified threshold k4, that is, N(t)/T(t) ^ k4, it will be judged that 
an attack is in progress ." 

However, Chao discloses, in one embodiment, DCS 108 performing aggregation 
function 222 by comparing measured attribute values to nominal attribute values, 
wherein if the measured attribute value exceeds a predetermined threshold, DCS 1 08 
may conclude that the packets are suspect, as in part of an attack (see at least Figure 
5 and Col. 9, lines 30-38: as stated by Chao's disclosure, one skilled In the art 
would appreciate that various thresholds and combinations thereof may be used 
to determine whether packets are suspect). 

Therefore it would have been obvious to a person having ordinary skill in the art 
at the time the invention was made to modify Chesia and Apap and incorporate Chao to 
meet the preceding limitations not explicitly disclosed by Chesia and Apap. The 
motivation is to provide a distributed, adaptive Internet Protocol (IP) filtering system and 
technique to detect and block packets involved in a DDoS attack (Chao: Col. 2, lines 
57-60). 

As per claim 21 , Chesia in view of Apap and Chao discloses the method of claim 
20, wherein. 
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said examining step examines a resultant composite field comprising arbitrary 
combinations of two or more of header fields, and the number of distinct values 
observed for the resultant composite field is used to compute the coefficient which is 
compared against the threshold (see at least Chesia: Para. [0025-0026]: for example, 
as part of measuring a property of traffic entering the network and applying a 
fuzzy logic algorithm to detect an attack). 

As per claim 22, Chesia in view of Apap and Chao discloses the method of claim 
20, comprising the further steps of: from an examined packet, inferring that the 
unauthorized attack is underway when a Time To Live (TTL) value in the pre-specified 
field of the examined packet is outside a range of the values seen beforehand for the 
source address in the header of the examined packet, and after determining that the 
source address in the header of the examined packet is legitimate, detecting the 
unauthorized attack based on whether the TTL value is within a pre-specified range of 
the expected TTL value for the source address (see at least Chesia: Para. [0025- 
0026]; [0045]: for example, as part of measuring a property of traffic entering the 
network and applying a fuzzy logic algorithm to detect an attack; packet header 
fields that are monitored include time-to-live (TTL), source IP address, packet 
size, and so on). 
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13. Claims 18-19 are rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Chesia in view of Apap as applied to claims 13 and 14 above, and further in view of 
Chao. 

As per claim 1 8, Chesia In view of Apap discloses the network attack tracking 
system according to claim 13. 

Chesia in view of Apap does not explicitly disclose: 

" wherein a source of the unauthorized attack is searched by deploying these 
systems at various places on the Internet." 

However, Chao discloses denial-of-service control servers that are distributed in 
a given network to form a system configured to protect against DDoS attack (see at 
least Fig. 1 and Col. 3, lines 56-67). 

Therefore it would have been obvious to a person having ordinary skill in the art 
at the time the invention was made to modify Chesia and Apap and incorporate Chao 
such that the system as being characterized in that a source of the unauthorized attack 
is searched by setting these systems at various places on the Internet. The motivation 
is to provide a distributed, adaptive Internet Protocol (IP) filtering system and technique 
to detect and block packets involved in a DDoS attack (Chao: Col. 2, lines 57-60). 

As per claim 19, Chesia in view of Apap discloses the network attack tracking 
system according to claim 14. 

Chesia in view of Apap does not explicitly disclose: 
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" wherein tine source of tine unautliorized attacl^ is searched by deDloving these 
systems at various places on the Internet." 

However, Chao discloses denial-of-service control servers that are distributed in 
a given network to form a system configured to protect against DDoS attack (see at 
least Fig. 1 and Col. 3, lines 56-67). 

Therefore it would have been obvious to a person having ordinary skill in the art 
at the time the invention was made to modify Chesia and Apap and incorporate Chao 
such that the system as being characterized in that a source of the unauthorized attack 
is searched by setting these systems at various places on the Internet. The motivation 
is to provide a distributed, adaptive Internet Protocol (IP) filtering system and technique 
to detect and block packets involved in a DDoS attack (Chao: Col. 2, lines 57-60). 

Conclusion 

14. The prior art made of record and not relied upon is considered pertinent to 
Applicant's disclosure: 

Lyon (US 7,478,429) - this reference discloses system and method for detecting 
and mitigating network overload. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to NARCISO VICTORIA whose telephone number is 
(571)270-7904. The examiner can normally be reached on Monday to Friday 10:00am - 
6:00pm EST. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Taghi Arani can be reached on (571)272-3787. The fax phone number for 
the organization where this application or proceeding is assigned is 571 -273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/NV/ 

/Taghi T. Arani/ 

Supervisory Patent Examiner, Art Unit 2438 



